year value for ausearch?

year value for ausearch?

[LC Bruzenak]

Just got word back from a non-US fielded system that the ausearch -ts
DAY/MONTH/YEAR doesn't work, e.g. :
% ausearch -ts 04/29/2010 
says that the year value is invalid

but
% ausearch -ts 04/29/10 works.

Something with locale? It's F10 audit.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: year value for ausearch?

[LC Bruzenak]

On Thu, 2010-04-29 at 00:39 -0500, LC Bruzenak wrote:
> Just got word back from a non-US fielded system that the ausearch -ts
> DAY/MONTH/YEAR doesn't work, e.g. :
> % ausearch -ts 04/29/2010 
> says that the year value is invalid
> 
> but
> % ausearch -ts 04/29/10 works.
> 
> Something with locale? It's F10 audit.
> 
> Thx,
> LCB.

Sorry I meant MONTH/DAY/YEAR as in the example.

Looking at the code it appears to use the locale's format, so it is
likely I will need to change the ausearch input to match.?.

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: year value for ausearch?

[Steve Grubb]

On Thursday 29 April 2010 02:50:02 pm LC Bruzenak wrote:
> On Thu, 2010-04-29 at 00:39 -0500, LC Bruzenak wrote:
> > Just got word back from a non-US fielded system that the ausearch -ts
> > DAY/MONTH/YEAR doesn't work, e.g. :
> > % ausearch -ts 04/29/2010
> > says that the year value is invalid
> > 
> > but
> > % ausearch -ts 04/29/10 works.
> > 
> > Something with locale? It's F10 audit.

Yes, exactly.
 
> Sorry I meant MONTH/DAY/YEAR as in the example.
> 
> Looking at the code it appears to use the locale's format, so it is
> likely I will need to change the ausearch input to match.?.

Yes. It should be documented in the --start --end portion of the man page. 
What the exact format is for the locale you are in is not covered.

-Steve

Re: year value for ausearch?

[LC Bruzenak]

On Fri, 2010-04-30 at 10:24 -0400, Steve Grubb wrote:
> 
> Yes. It should be documented in the --start --end portion of the man page. 
> What the exact format is for the locale you are in is not covered.

Thanks Steve, I believe if I use the "%x" date switch I will get what I
need for the ausearch input start time, regardless of the locale.

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: year value for ausearch?

[Steve Grubb]

On Friday 30 April 2010 03:10:42 pm LC Bruzenak wrote:
> On Fri, 2010-04-30 at 10:24 -0400, Steve Grubb wrote:
> > Yes. It should be documented in the --start --end portion of the man
> > page. What the exact format is for the locale you are in is not covered.
> 
> Thanks Steve, I believe if I use the "%x" date switch I will get what I
> need for the ausearch input start time, regardless of the locale.

You can also do this on the command line:

LANG=en_US.UTF-8; ausearch --start 01/30/2010

-Steve